So when a Sandbox is refreshed or created, everyone's email gets changed so that it has
.invalid on the end.
This seems to have the useful side effect of stopping users from logging in - when they first try to access the sandbox, Salesforce tries to email them a verification code and they can't get the email, so they can't log in until and admin corrects their email address.
In terms of sandbox security (particularly full copy sandboxes) this seems quite useful.
My question is: Is this a hard and fast rule that I can rely on - that users wont be able to log into a fresh sandbox unless someone fixes their email address - or are there some situations when a verification code is not required and hence users can get straight into a sandbox.
In short, I need to know if this is an 'official' feature or just some happy accident that depends on other security settings around verification codes. I'm writing something about sandbox security and need to know how reliable this is ....